President's Message From the Editor's Desk TBD In the Spotlight: Human Performance Data Collection in Theory and Practice Security in Child-Checking Applications Chapter News Mark Your Calendar Opinion From Our Readers About this Journal Classifieds Advertising in eJSS Contact Us Puzzle

Vol. 43, No. 3 • May-June 2007
In the Spotlight

Security in Child-Checking Applications:
Where Any Vulnerability Presents Too Great a Risk

Pages 1 | 2 | 3

Authorization Required for New Parents

The parent who first sets up the application becomes the primary parent, and has full control over who else may use it to obtain child location information. Adding an additional parent (i.e., anyone who has permission to retrieve child location data) always requires authorization from the primary parent.

Additional parent phones must be set up by the primary parent, who then must approve the new parent phones. In this process, a message is sent from the new parent phone to the child's phone, which then seeks permission from the primary parent phone to authorize that new parent to retrieve location information for that child's phone. The primary parent must then actively confirm that permission. Absolutely no child location information is transmitted to the new parent until the primary parent completes the authorization process by confirming the new parent's privileges.

Forced Re-initialization When a Password is Re-set

In a family's busy life, cellular phones may be lost or stolen. However, with proper security features, the loss of a phone will not put a child's location data at risk. The parent must input the password in order to launch the application. Re-setting the password forces the application to re-initialize, erasing all of the family information stored in the application's database. Thus, if an imposter or a stranger attempts to gain control over the application by re-setting the password, he or she will obtain no information about the whereabouts of a child.

Anonymous Reverse Geocoding

Geocoding is the process of mapping geographic coordinates (latitude and longitude) to street addresses or other location data. Reverse geocoding matches an address to a specific latitude-longitude pair. These operations generally take place by requesting information from a Geographic Information System (GIS). A child's security may be put at risk if such a request can be matched to a specific child. However, responsible engineering teams remove this vulnerability.

When a secure child-locator application requests a reverse geocoding from any GIS, no information about the requestor (name, phone number or any other personal identifier) is transmitted. Only the geographical coordinates are sent, and thus there is no way to link these coordinates to an actual user.

Blanket Security Protection, Serving Many Needs

Protection of children is paramount — however, many others need the security afforded by locator applications. These include families caring for elderly parents, individuals traveling alone, anyone working a night shift or transporting valuable cargo … the list is endless. In personal safety, any vulnerability is too great a risk.

Conclusion

Security must be designed into child-locator applications. If it is treated as an add-on or a retrofit, then it is a separate, non-integrated component, and one that could easily fail. Secure applications are those that were created to be secure from the initial concept and throughout the product's entire life cycle.

Server-less technology is essential to such application security, and its use demonstrates absolute commitment to safety and security. Its multiple layers of security, and its dedication to the elimination of risk (rather than simple mitigation), are a testament to engineering expertise, as well as product excellence.

About the Author

Steve Manson has been an acknowledged pioneer and innovator in the software industry for more than 20 years. He currently serves as the CEO of Celltitude, Inc. Prior to joining Celltitude, he served as CEO of computer-telephony pioneer Artisoft, Inc., where he successfully transformed the company from a declining network vendor into one of the fastest-growing IP-PBX vendors in the world. He has also held senior executive positions with Gensym, Cadre Technologies and Prime Computer.

« previous page